CVE-2026-47237

Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user's account and the data that is processed by that user. The attacker needs a valid user with the ``kubeflow-edit`` role / Contributor role in a random Kubeflow namespace to perform this attack. This is given if _Automatic Profile Creation_ is enabled. Version 26.03-rc.1 fixes the issue.

• CWE-266

• https://github.com/kubeflow/community-distribution/commit/31b2411dda319bfeae8686ecdf3a39436ec32ce2
• https://github.com/kubeflow/community-distribution/pull/3043
• https://github.com/kubeflow/community-distribution/security/advisories/GHSA-v824-8gxh-pgjw
• https://github.com/kubeflow/community-distribution/security/advisories/GHSA-v824-8gxh-pgjw

Published

Jul 21, 2026

Last Modified

Jul 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47230Admidio is an open-source user management solution. Prior to…6.5
• CVE-2026-47231Admidio is an open-source user management solution. Prior to…8.1
• CVE-2026-47232Admidio is an open-source user management solution. Prior to…4.3
• CVE-2026-47233Admidio is an open-source user management solution. Version …6.5
• CVE-2026-47234Admidio is an open-source user management solution. Prior to…4.4
• CVE-2026-47236Solidtime is an open-source time-tracking app. Prior to vers…4.3
• CVE-2026-47238ClipBucket v5 is an open source video sharing platform. Prio…6.5
• CVE-2026-4724Undefined behavior in the Audio/Video component. This vulner…9.1
• CVE-2026-47240Net::IMAP implements Internet Message Access Protocol (IMAP)…5.8
• CVE-2026-47241Net::IMAP implements Internet Message Access Protocol (IMAP)…2.1
• CVE-2026-47242Net::IMAP implements Internet Message Access Protocol (IMAP)…5.8
• CVE-2026-47243Kata Containers is an open source project focusing on a stan…9.2